A 62-Item Register, a Growth Bet, and a Single EHR
North Valley Health System operates four hospitals and is committing $120 million to a three-year ambulatory expansion. Its ERM committee maintains a 62-item risk register that each facility built independently. The board-approved appetite statement says the system has low tolerance for patient safety events and a strong appetite for growth that strengthens market position. The CRO notes three items that never appear together in any single view: a 14% nursing vacancy rate, a planned tightening of staffing ratios to help fund the expansion, and a single centralized EHR whose tested recovery time is 96 hours. Two professional liability insurers have asked for the ERM summary before quoting the renewal.
1. Explain why a facility-built register fails as an ERM tool in this situation, and characterize the relationships among the three items the CRO flagged.
Read the worked answer
Why the register fails. A register assembled facility by facility captures what each facility can see. That systematically over-weights frequent, familiar hazard risks (slips, falls, equipment breakdown) and under-weights risks that only exist at the enterprise level: correlated risk, concentration, strategic risk, and risk created by the company's own capital decisions. Sixty-two items is evidence of effort, not of coverage. The register has no interdependency view, no exposure or likelihood quantification, no owner above facility level, and no connection to how capital is actually allocated.
The three flagged items are one causal chain, not three risks. The growth decision creates a funding requirement, which produces a staffing-ratio reduction, which interacts with a 14% vacancy rate to push actual staffing below the level at which patient safety events rise. That is a strategic decision transmitting into an operational hazard exposure, and then into professional liability claims, regulatory scrutiny, and reputation. The register lists the pieces and misses the transmission.
The EHR is a different animal: a common-mode failure. Four hospitals sharing one instance means a single outage or cyber event is not four independent events each hitting a quarter of the system. It is one event hitting all of it, with a 96-hour recovery time. Correlated exposure of that kind should be aggregated into a single enterprise-level risk with one owner, not distributed across four facility lists.
What you would do instead: aggregate by risk rather than by location, test completeness against a taxonomy (strategic, operational, financial, hazard), and run a bow-tie or scenario analysis on the staffing and EHR chains.
2. How would you test the appetite statement against the expansion decision, and what would you recommend if the test fails?
Read the worked answer
Test whether the statement is operational. It contains two clear directions but no boundaries. Low tolerance for patient safety events is a preference, not a limit; it has no quantified tolerance, no metric, and no owner. Strong appetite for growth is unconstrained by any capacity test. A statement that cannot be violated cannot govern a decision.
Apply it as a boundary condition. The growth appetite should be read as permission to accept growth risk within the other stated tolerances, not as a competing objective that outweighs them. So ask the operational question: does the expansion plan depend on staffing reductions that push ratios into the range where serious safety events rise? If it does, the plan sits outside appetite regardless of how attractive the growth is, and no amount of growth appetite cures that.
Make the tolerances real:
- Define a quantified safety tolerance (for example, zero serious safety events, or a rate per 10,000 patient days) with a named executive owner.
- Set a staffing KRI with a floor below which the expansion may not proceed.
- Require that capital requests state which risks they increase and how those stay inside tolerance.
- Set a return hurdle that is risk-adjusted, so growth is priced against the risk it creates.
If the test fails, do not resolve it in the ERM committee. Present the specific conflict to the board with the numbers, offer the options (slow the ratio reduction, phase the expansion, fund recruitment, or formally re-price the growth appetite), and document the board's decision either way. The value of ERM here is making the trade-off visible and owned, not making it disappear.
3. What would you put in the ERM summary given to the professional liability insurers, and what would you deliberately leave out?
Read the worked answer
Include, because it is decision-useful and defensible:
- Governance: board and committee oversight, the CRO's authority, how risk enters capital decisions.
- The enterprise risk profile: top risks with some quantification, including the staffing and EHR concentration issues, stated honestly.
- Loss experience and trends by facility, with the exposure denominators that make them comparable.
- Current risk financing structure, retentions, and how retentions were selected.
- Risk-control initiatives in flight, with owners and dates (sprinkler-equivalent items: recruitment pipeline, staffing floors, EHR recovery testing).
- The scenarios you have run and what they showed.
Exclude:
- Register items presented as if validated when they are unquantified hunches; a speculative list invites pricing for risks you do not have.
- Privileged material: peer review, credentialing records, incident investigations conducted under privilege, and counsel work product. Send the summary, not the file.
- Individual personnel matters and anything you would not want read aloud in a deposition.
The governing tension: an application is a representation, and material misrepresentation can void coverage. So the test is not what is flattering, it is what is accurate and material. Disclose the staffing and EHR exposures plainly and pair each with the control you are building. That is how you get a quote you can rely on later.